Critical DLL Sideloading Attack Uses OneDrive.exe to Run Malicious Code

Security researchers have uncovered a sophisticated attack technique that weaponizes Microsoft OneDrive to execute arbitrary code while evading traditional security defenses.

The method, known as DLL sideloading, exploits how Windows loads dynamic library files, transforming a trusted application into a vector for code injection and system compromise.

Understanding the Attack Mechanism

The vulnerability originates from Windows’ predictable library search order.

When OneDrive.exe launches, the operating system searches for required files such as version.dll in multiple locations, checking the application’s directory first before accessing system folders.

Attackers exploit this behavior by placing a malicious version.dll in OneDrive’s directory, causing the application to unknowingly load attacker-controlled code instead of legitimate Microsoft libraries.

This approach proves particularly dangerous because malicious code executes within OneDrive.exe’s trusted process context, inheriting system-level permissions and network access.

Security tools frequently trust Microsoft-signed processes, making this technique exceptionally effective at bypassing endpoint detection and response systems.

Recent proof-of-concept demonstrations reveal additional sophistication beyond basic DLL sideloading.

The malicious library employs DLL proxying, a technique that maintains application compatibility by exporting identical functions as the legitimate version.dll.

The malicious code forwards legitimate calls to the real system library, allowing OneDrive to function normally while attackers operate invisibly in the background.

The implementation further uses advanced API hooking through Vectored Exception Handling and memory page protection techniques.

Rather than modifying code in detectable ways, the attack intercepts Windows API function calls.

When OneDrive attempts to execute CreateWindowExW, the hooking mechanism captures this action and redirects execution to attacker-controlled code, continuously re-arming itself throughout the application’s runtime.

In proof-of-concept demonstrations, attackers achieve arbitrary code execution through process creation after a two-second delay.

This timing technique allows the initial OneDrive process to appear legitimate before the actual attack initiates.

While demonstrations use simple processes like Notepad, actual attacks could deploy ransomware, steal credentials, establish backdoors, or create command-and-control connections.

Organizations using OneDrive for file synchronization face a particular risk since the application maintains persistent elevated permissions and network connectivity.

An attacker gaining code execution within OneDrive can access synchronized files, exfiltrate sensitive documents, establish persistence on corporate networks, and move laterally to other systems.

Hybrid work environments present additional concerns, as employees often synchronize corporate data through OneDrive across personal and corporate devices.

Organizations should implement multiple detection layers, including monitoring for unexpected DLL files in application directories, restricting library loading locations, and implementing behavioral analysis for suspicious process creation from trusted applications.

Security teams should review OneDrive deployment configurations and ensure file integrity monitoring is enabled for critical application directories to detect unauthorized modifications.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today